Browse / Misconfiguration

Misconfiguration

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Violation of Secure Design Principles839
• Misconfiguration173
• UI Redressing (Clickjacking)151
• Phishing41
• Insufficient Logging24
• Security Through Obscurity7
• Improper Check or Handling of Exceptional Conditions6
• User Interface (UI) Misrepresentation of Critical Information6
• Cache Poisoning4
• Insecure Temporary File4
• Acceptance of Extraneous Untrusted Data With Trusted Data3
• Using Components with Known Vulnerabilities2
• Origin Validation Error1
• Content Spoofing1
• Improper Handling of Exceptional Conditions1

Often found together with

• Access Control200
• Authentication153
• Information Disclosure123
• Cross-site Scripting122
• Cross-Site Request Forgery70
• Business Logic48
• Code Execution40
• Denial of Service31
• Insecure Direct Object Reference30

Most upvoted Misconfiguration reports

AllValidInformativeN/ADuplicate

1. Emails from Grammarly missing sanitization(lack of validation?) -> HTML injection in emailsDuplicateViolation of Secure Design Principles · low · Superhuman (formerly Grammarly)
   22 votes
2. Introspection query leaks sensitive graphql system information.DuplicateViolation of Secure Design Principles · HackerOne
   22 votes
3. Missing SPF Records.DuplicateMisconfiguration · medium · MyCrypto
   18 votes
4. Route53 Subdomain Takeover on test-cncf-aws.canary.k8s.ioDuplicateMisconfiguration · high · Kubernetes
   13 votes
5. Password reset token leakageDuplicateMisconfiguration · high · UPchieve
   12 votes
6. javascript: and mailto: links are allowed in JIRA integration settingsDuplicateViolation of Secure Design Principles · low · HackerOne
   12 votes
7. CORS MisconfigurationDuplicateMisconfiguration · Sifchain
   11 votes
8. Clickjacking Vulnerability in sifchain.financeDuplicateUI Redressing (Clickjacking) · Sifchain
   11 votes
9. Bruteforce INVITE codes easy wayDuplicateViolation of Secure Design Principles · Uber
   10 votes
10. CORS Misconfiguration Leads to Sensitive Exposure on Sifchain main domainDuplicateMisconfiguration · Sifchain
    8 votes
11. Clickjacking misconfiguration bugDuplicateUI Redressing (Clickjacking) · Sifchain
    7 votes
12. UI Redressing ( ClickJacking ) Issue on Information submit form DuplicateUI Redressing (Clickjacking) · Legal Robot
    7 votes
13. IMAP custom FETCH literals can spoof tagged responses and desynchronize reused connectionsDuplicateViolation of Secure Design Principles · curl
    6 votes
14. Email Spoofing on sifchain.financeDuplicateViolation of Secure Design Principles · low · Sifchain
    6 votes
15. Cross Origin Resource Sharing Misconfiguration | Lead to sensitive information.DuplicateMisconfiguration · Sifchain
    6 votes
16. Vulnerable for clickjacking attackDuplicateUI Redressing (Clickjacking) · Sifchain
    6 votes
17. Email SpoofingDuplicatePhishing · medium · Nextcloud
    6 votes
18. SSL cookie without secure flag setDuplicateMisconfiguration · medium · Stripo Inc
    6 votes
19. Error page Text Injection.DuplicateViolation of Secure Design Principles · Vimeo
    6 votes
20. Missing Two Factor Authentication in /admin/loginDuplicateViolation of Secure Design Principles · CFP Time
    5 votes
21. Missing SPF Flags on nextcloud.comDuplicateViolation of Secure Design Principles · Nextcloud
    5 votes
22. Click JackingDuplicateUI Redressing (Clickjacking) · Legal Robot
    5 votes
23. CLICKJACKING LEADS TO DEACTIVATE ACCOUNTDuplicateUI Redressing (Clickjacking) · low · UPchieve
    4 votes
24. Content SpoofingDuplicateViolation of Secure Design Principles · low · Weblate
    4 votes
25. Cookie HttpOnly Flag Not Set DuplicateMisconfiguration · Gratipay
    4 votes
26. DNS MisconfigurationDuplicateMisconfiguration · U.S. Dept Of Defense
    4 votes
27. Access to Amazon S3 bucketDuplicateViolation of Secure Design Principles · DigitalSellz
    4 votes
28. Clickjacking: X-Frame-Options header missingDuplicateUI Redressing (Clickjacking) · Legal Robot
    4 votes
29. Missing X-Frame-Options headerDuplicateUI Redressing (Clickjacking) · Yelp
    4 votes
30. Cookies are not cleared from Server side on LogoutDuplicateMisconfiguration · Mavenlink
    4 votes
31. CORS (Cross-Origin Resource Sharing) origin validation failureDuplicateMisconfiguration · Sifchain
    3 votes
32. Content spoofing on error pages or text injectionDuplicateViolation of Secure Design Principles · low · CFP Time
    3 votes
33. Clickjacking: Delete Account, Change privacy settings, Rate business, follow/unfollow (IE)DuplicateUI Redressing (Clickjacking) · medium · Eternal
    3 votes
34. com.reddit.frontpage vulernable to Task Hijacking (aka StrandHogg Attack)DuplicatePhishing · medium · Reddit
    2 votes
35. Missing SPF record for the in scope domainDuplicatePhishing · medium · MyCrypto
    2 votes
36. Allowance of Meta/Null charactersDuplicateViolation of Secure Design Principles · medium · Legal Robot
    2 votes
37. Click jacking in delete image of user in YelpDuplicateUI Redressing (Clickjacking) · medium · Yelp
    2 votes
38. Host Header Injection/RedirectionDuplicateViolation of Secure Design Principles · RubyGems
    2 votes
39. Host Header poisoning on gratipay.comDuplicateViolation of Secure Design Principles · Gratipay
    2 votes
40. prevent content spoofing on /~username/emails/verify.htmlDuplicateViolation of Secure Design Principles · Gratipay
    2 votes
41. Missing SPFDuplicateViolation of Secure Design Principles · Paragon Initiative Enterprises
    2 votes
42. Email Authentication bypass VulnerabilityDuplicateViolation of Secure Design Principles · Paragon Initiative Enterprises
    2 votes
43. 20: HTAB before `Secure` attribute silently drops the Secure cookie flagDuplicateMisconfiguration · curl
    1 votes
44. Vulnerability : Email SpoofingDuplicateViolation of Secure Design Principles · Sifchain
    1 votes
45. Email Spoofing bugDuplicateViolation of Secure Design Principles · Sifchain
    1 votes
46. Nextcloud Clickjacking VulnerabilityDuplicateUI Redressing (Clickjacking) · low · Nextcloud
    1 votes
47. Clickjacking on https://download.nextcloud.com/DuplicateUI Redressing (Clickjacking) · Nextcloud
    1 votes
48. Clickjacking on https://download.nextcloud.comDuplicateUI Redressing (Clickjacking) · Nextcloud
    1 votes
49. The csrf token remains same after user logs inDuplicateViolation of Secure Design Principles · Liberapay
    1 votes
50. Email SpoofingDuplicateViolation of Secure Design Principles · medium · Semrush
    1 votes
51. Arbitrary local code execution via DLL hijacking from executable installerDuplicateViolation of Secure Design Principles · medium · Brave Software
    1 votes
52. Possible user session hijack by invalid HTTPS certificate on inside.gratipay.com domainDuplicateViolation of Secure Design Principles · low · Gratipay
    1 votes
53. Email SpoofingDuplicateViolation of Secure Design Principles · Gratipay
    1 votes
54. homograph-attack (unicode vuln)DuplicateViolation of Secure Design Principles · Brave Software
    1 votes
55. ClickJackingDuplicateUI Redressing (Clickjacking) · OWOX, Inc.
    1 votes
56. ClickJacking DuplicateUI Redressing (Clickjacking) · Yelp
    1 votes
57. Cookie:HttpOnly Flag not setDuplicateViolation of Secure Design Principles · Gratipay
    1 votes
58. Missing SPF for hackerone.comDuplicateViolation of Secure Design Principles · bitaccess
    1 votes
59. Missing SPF for paragonie.comDuplicateViolation of Secure Design Principles · Paragon Initiative Enterprises
    1 votes
60. Missing SPF for paragonie.comDuplicateViolation of Secure Design Principles · Paragon Initiative Enterprises
    1 votes
61. Missing SPF records for paragonie.comDuplicateViolation of Secure Design Principles · Paragon Initiative Enterprises
    1 votes
62. Email spoofingDuplicateViolation of Secure Design Principles · Paragon Initiative Enterprises
    1 votes
63. Wrong Url in Main page of sifchain.financeDuplicateMisconfiguration · low · Sifchain
64. Design Issues at Main DomainDuplicateViolation of Secure Design Principles · low · Sifchain
65. Clickjacking on https://nextcloud.com/DuplicateUI Redressing (Clickjacking) · Nextcloud
66. Error Page Content Spoofing or Text InjectionDuplicateViolation of Secure Design Principles · GSA Bounty